Capa
Monthly
Mandiant FLARE capa versions before 10.0.0 deserialize untrusted data from .viv and .exe.viv workspace files, enabling arbitrary code execution when an analyst opens a crafted workspace. Exploitation is local and requires user interaction plus an additional attack prerequisite (CVSS:4.0 AV:L/AC:H/AT:P/UI:A), so it is not remotely triggerable and no public exploit code or active exploitation has been identified at time of analysis. The 8.7 vendor score reflects high confidentiality, integrity, and availability impact, but the practical risk is confined to workflows that load untrusted or third-party workspace files.
Mandiant FLARE capa versions before 10.0.0 deserialize untrusted data from .viv and .exe.viv workspace files, enabling arbitrary code execution when an analyst opens a crafted workspace. Exploitation is local and requires user interaction plus an additional attack prerequisite (CVSS:4.0 AV:L/AC:H/AT:P/UI:A), so it is not remotely triggerable and no public exploit code or active exploitation has been identified at time of analysis. The 8.7 vendor score reflects high confidentiality, integrity, and availability impact, but the practical risk is confined to workflows that load untrusted or third-party workspace files.